FBI Urges Businesses & Consumers to Reboot Routers

The FBI is urging small businesses, as well as consumers, to reboot and restart their routers, following a disclosure last week of a particularly sophisticated piece of botnet malware.

The malware, dubbed VPNFilter, was discovered by the Secret Service of Ukraine and dissected by researchers at Cisco Talos and Symantec. The FBI later gained control of some of the servers used in the attack. These domains are the ones that allowed the malware to regenerate itself.

Overall, Talos and Symantec believe that VPNFilter infected some 500,000 routers and Network Attached Storage (NAS) devices mostly used by small businesses and home users. (See FBI Knocks Out VPNFilter Malware That Infected 500K Routers.)

In its warning, the FBI, along with the US Justice Department, offered a few additional details about VPNFilter, including the agency's belief that the Sofacy cyber espionage group was behind the development and spread of the malware.

(Source: Flickr)

Sofacy is also known as Fancy Bear or APT28, which many security experts believe is backed by the Russian government, and is involved in a series of cyber espionage incidents throughout the world. (See Fancy Bear Linked to DealersChoice Attacks in Europe.)

What made VPNFilter particularly complex is that the malware was developed as a three-stage attack. The first stage reloads the malware after a reboot, which would normally erase the infection. The second stage contains the main payload and Stage 3 consists of plugins that work with the second-stage payload.

Now entering its fifth year, the 2020 Vision Executive Summit is an exclusive meeting of global CSP executives focused on navigating the disruptive forces at work in telecom today. Join us in Lisbon on December 4-6 to meet with fellow experts as we define the future of next-gen communications and how to make it profitable.

When the FBI seized the domains last week, agents took control of the servers that were part of Stage 1, meaning that the malware could not regenerate itself.

Still, the FBI is urging those businesses and home users to reboot their devices.

"Owners of SOHO and NAS devices that may be infected should reboot their devices as soon as possible, temporarily eliminating the second stage malware and causing the first stage malware on their device to call out for instructions. Although devices will remain vulnerable to re-infection from the second stage malware while connected to the Internet, these efforts maximize opportunities to identify and remediate the infection worldwide in the time available before Sofacy actors learn of the vulnerability in their command-and-control infrastructure."

Last week, Symantec released a list of possibly infected devices:

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.